Commit graph

1881 commits

Author SHA1 Message Date
Carl Tashian
2c09baf696 Two small systemd changes
1. Don't halt the cert renewer service from ExecStartPost ops if a relying service doesn't exist; halt it if the relying service exists and doesn't restart properly.
2. Use /bin/env bash instead of /bin/bash for portability.
2021-03-16 17:08:27 -07:00
max furman
3b9eed003d [action] set goreleaser config values back to default 2021-03-15 12:27:29 -07:00
max furman
6861202762 go.sum update 2021-03-15 11:23:06 -07:00
max furman
6d879affa4 [action] remove duplicate step in job 2021-03-15 11:01:14 -07:00
Carl Tashian
33bba8fcd5 Fix goreleaser indentation issue 2021-03-15 11:00:46 -07:00
Carl Tashian
7249f495a9
Merge pull request #503 from smallstep/carl/goreleaser-windows
Add step-ca Windows build & Scoop release to goreleaser
2021-03-15 10:41:11 -07:00
Herman Slatman
a4844fee7b
Make tests green 2021-03-12 16:58:52 +01:00
Herman Slatman
99952080c7
Make tests not fail hard on ECDSA keys
All tests for the Authority failed because the test data
contains ECDSA keys. ECDSA keys are no crypto.Decrypter,
resulting in a failure when instantiating the Authority.
2021-03-12 16:27:26 +01:00
Herman Slatman
e30084c9a8
Make linter happy 2021-03-12 16:02:00 +01:00
Herman Slatman
3e0dac3ab4
Fix certificateChain property 2021-03-12 15:51:16 +01:00
Herman Slatman
e1cab4966f
Improve initialization of SCEP authority 2021-03-12 15:49:39 +01:00
Herman Slatman
8c5b12e21d
Add non-TLS server and improve crypto.Decrypter interface
A server without TLS was added to serve the SCEP endpoints. According
to the RFC, SCEP has to be served via HTTP. The `sscep` client, for
example, will stop any URL that does not start with `http://` from
being used, so serving SCEP seems to be the right way to do it.

This commit adds a second server for which no TLS configuration is
configured. A distinct field in the configuration, `insecureAddress`
was added to specify the address for the insecure server.

The SCEP endpoints will also still be served via HTTPS. Some clients
may be able to work with that.

This commit also improves how the crypto.Decrypter interface is
handled for the different types of KMSes supported by step. The
apiv1.Decrypter interface was added. Currently only SoftKMS
implements this interface, providing a crypto.Decrypter required
for SCEP operations.
2021-03-12 14:18:36 +01:00
Herman Slatman
efd5501aca
Merge branch 'master' into hs/scep 2021-03-12 12:16:10 +01:00
Carl Tashian
192207d263 Add Windows build to goreleaser 2021-03-10 15:46:43 -08:00
Herman Slatman
538fe8114d
Fix linter issues 2021-03-10 22:39:20 +01:00
Herman Slatman
cc1ecb9438
Store new certificates in database 2021-03-10 22:20:02 +01:00
Mariano Cano
a98ea5f9cd
Merge pull request #502 from smallstep/windows-ui
Add support for cli-utils with powershell support.
2021-03-10 12:59:05 -08:00
Mariano Cano
d74f1fa55e Use cli-utils v0.2.0 2021-03-10 12:53:25 -08:00
Mariano Cano
a1a7e38a49 Add support for cli-utils with powershell support. 2021-03-10 12:34:47 -08:00
Herman Slatman
47c2a82d3b
Merge branch 'master' into hs/scep 2021-03-10 21:34:18 +01:00
Herman Slatman
9902dc1079
Add signed failure responses 2021-03-10 21:13:05 +01:00
Dominic Evans
9ee4441a79
Log successful /health requests at Trace lvl
Adds `STEP_LOGGER_ONLY_TRACE_HEALTH_ENDPOINT` environment variable to
opt-in to only logging successful /health requests at the Trace level

Fixes #420

Signed-off-by: Dominic Evans <dominic.evans@uk.ibm.com>
2021-03-09 14:52:13 +00:00
Carl Tashian
4d7338f763
Merge pull request #499 from smallstep/carl/readmes
Update "build from source" instructions
2021-03-08 13:58:41 -08:00
Carl Tashian
35be06f4aa Amendments to CONTRIBUTING doc 2021-03-08 13:54:55 -08:00
Herman Slatman
2536a08dc2
Add support for configuring capabilities (cacaps) 2021-03-07 00:50:00 +01:00
Herman Slatman
e4d7ea8fa0
Add support for challenge password 2021-03-07 00:30:37 +01:00
Herman Slatman
2d21b09d41
Remove some duplicate and unnecessary logic 2021-03-06 23:24:49 +01:00
Herman Slatman
99654f0efe
Merge branch 'master' into hs/scep 2021-03-06 22:47:36 +01:00
Herman Slatman
9df5f513e7
Change to a fixed fork of go.mozilla.org/pkcs7
Hopefully this will be a temporary change until
the fix is merged in the upstream module.
2021-03-06 22:35:41 +01:00
Herman Slatman
3a5f633cdd
Add support for multiple SCEP provisioners
Similarly to how ACME suppors multiple provisioners, it's
now possible to load the right provisioner based on the
URL.
2021-03-05 12:40:42 +01:00
Carl Tashian
c67531134a
Update CONTRIBUTING.md 2021-03-02 15:33:35 -08:00
Carl Tashian
b4d2368dfe
Update README.md 2021-03-02 15:31:16 -08:00
Carl Tashian
9248cfcc95
Update README with build from source link 2021-03-02 15:30:30 -08:00
Carl Tashian
a9e52405a2
Add CGO build instructions to contributing.md 2021-03-02 15:29:09 -08:00
max furman
94a895994f [action] pin to 1.15.8 not ^1.15.8
- was bumping all the way to 1.16
2021-03-02 14:27:02 -08:00
max furman
aef1e8ca7b [action] build artifacts in .releases dir to match actions 2021-03-02 14:02:08 -08:00
max furman
9cfdd2f3df [action] change step-certificates to step-ca where possible 2021-03-02 11:58:42 -08:00
max furman
8a1c8b394a [action] change debian package and src name in debian build files 2021-03-02 11:21:37 -08:00
max furman
43b4e5b4f8 [action] rename debian 2021-03-02 10:57:17 -08:00
max furman
ad48c8a881 [systemd file] add note about commenting sandboxing section for
troubleshooting
2021-03-01 15:48:07 -08:00
max furman
0aa96a936f [systemd] change executable location of step-ca 2021-03-01 15:42:34 -08:00
Herman Slatman
2fc5a7f22e
Improve SCEP API logic and error handling 2021-02-27 00:34:50 +01:00
Herman Slatman
a6d50f2fa0
Remove x509 template from API 2021-02-26 18:07:50 +01:00
Herman Slatman
311c9d767b
Add AuthorizeSign method to SCEP authority 2021-02-26 14:00:47 +01:00
Herman Slatman
4322933588
Add handling of options 2021-02-26 12:32:43 +01:00
Herman Slatman
19f0397fe9
Remove the copy of mozilla/pkcs7
Apparently the existing library works out of the box, after all.

We'll have to see how it works out continuing forward.
2021-02-26 00:55:37 +01:00
Herman Slatman
7948f65ac0
Merge branch 'master' into hs/scep 2021-02-26 00:41:33 +01:00
Herman Slatman
7ad90d10b3
Refactor initialization of SCEP authority 2021-02-26 00:32:21 +01:00
Herman Slatman
f871f8135c
Add full copy of mozilla/pkcs7 module as internal dependency
The full contents of the git repository @432b2356ecb...
was copied. Only go.mod was removed from it.
2021-02-25 22:28:08 +01:00
max furman
8b4bbd3d39 go mod tidy 2021-02-24 12:57:31 -08:00